Mickey Haslavsky: Hello everyone and welcome to the Autonomous Business Podcast at Forbes and enso This is a super, super, super exciting episode about cybersecurity. Today we're hosting Marina Segel, ⁓ who's the co-founder and CEO of Tamnoon.io which is building a platform for agentic remediation. And today we're going to learn basically how to deal with this extreme velocity of AI. ⁓ when it comes to protecting your organization or any organization in terms of cybersecurity. So thank you so much for your time, Marina.
Marina Segal: Thank you, Mickey, for having me.
Mickey Haslavsky: Absolutely. know, cybersecurity has spent years in selling, you know, more visibility, more alerts, more dashboards. And we're getting into a new world where we're saying no more dashboards. It's time for action, which is basically what AI agents are about. Tell me about how you see this world and how can the world protect itself from the extreme velocity of AI.
Marina Segal: Well, we definitely are at the intersection of ⁓ the change in the whole landscape of cybersecurity. We basically seeing that the mass of the defense is changing. have an asymmetrical problem. The attackers are way faster and they don't care about safety. They can break in. They don't care if anything will be running or not. And we are as people who are protecting the industry from from the attackers need to be very careful because we also are on hook for not breaking anything that is working in our operational systems. So the mass of the defense is definitely changing and velocity definitely is one of the hardest problems that we need to solve as an industry.
Mickey Haslavsky: When you're thinking about this whole new world in which new standards and maybe the entire user experience and the way we build stuff is basically changing every, I assume every three months we see like 180 degrees, something new open-closed and there was something else. Like there's literally something new every once in a while. How do you keep up with the speed and how would you... you know, advice people who are just overwhelmed, I assume, with the speed, even have the ability to even keep up with the speed. I'm not even talking about the attackers themselves.
Marina Segal: Yeah, it's definitely a very challenging but also very interesting time to live in because we kind of are reinventing the space right now. If ⁓ about a year ago, we were dealing with developers who are building products and writing code. Today, each developer has a team of agents that are working nearby and are building alongside. So the scale of deployment the amount of pull requests, everything is at scale these days. And ⁓ we are facing as a security teams, I think we also need to adapt to the same mindset that nowadays each security analyst is no longer just an analyst. We have a team of agents that are helping us to secure, not only to build our systems. So the... mindset shift needs to be that each one of us is now managing a team of security experts who are helping to be more productive. ⁓ So nowadays, I think our focus should be on operations and on how to make this whole ⁓ system of agents with human in the loop to be the most productive and the most efficient at any given moment.
Mickey Haslavsky: You know, I want to share my experience with you a little bit. We're selling to different companies all the way from 30 employees to 1000 employees ⁓ with agent to go to market solutions. And every time I walk into a room and I present what we do, there are two types of people. ⁓ Person number one is extremely excited by the opportunity to just outsource or offload some of this extreme work. to agents because they have the ability to scale. The other person is extremely concerned with what this will do to the organization and how this will even change this idea of autonomous software that will do stuff for them. And I think we moved ⁓ somewhere from we found the risk to we solved the risk and leaders are feeling uncomfortable but really want to be forward. How would you advise any leader in any organization to deal with this ⁓ some type of dilemma?
Marina Segal: Yeah, I think we having a psychological problem. think we kind of need a group therapy for the entire industry here because we've been living for a very long time with a perception that our career advancement, the more you move up of the ladder, the more people you need to manage. Right? So that was a very natural kind of an ego. mindset where, oh, my team is 20 people, my team is a hundred people. So the more people you have who are reporting to you, the more senior you are in the organization and the more proud you are of yourself. I think these days we need to understand that in order to make our organization successful, it's no longer about the size of your team, because in the end of the day, the agents are going to be significant in the amount they. I always want to add them to the org chart, right? So that people feel better about how many people report to them. And in the end of the day, it's no longer about the size of the team. It's about outcomes. We all talk about agent outcomes. And I think once the leaders start changing the mindset and making their people more senior because of the outcomes that they deliver rather than the amount of people that they manage, It will make the shift faster because when you're coming and selling an agent and we are seeing the same in the security industry, some people would push back and say, ⁓ I'm going to hire five people offshore and they will do the same. So, and, and it's kind of a counterintuitive for them to take an agent because it's not going to advance their career now. So why wouldn't they hire people offshore? So I think. Once we change the mindset of leaders and make them describe the career progression to their team members based on the outcomes, I think the faster we will make the shift into more ⁓ efficiency driven organizations.
Mickey Haslavsky: This is an interesting conversation because efficiency is such a relative thing in, you know, relative to the organization size and everybody see it in a completely different way. you know, I'll shift a little bit the conversation, but I'm curious about this. We also see, you know, projects such as Mitos or others that are, you know, so, or at least that's what they claim to be. So... ⁓ dangerous when it comes to exposure of any possible breach that the world doesn't want to let them publicly be available to everybody because they're too hard to navigate. But from the other hand, there are attackers, as you just said, and they're looking into any possible way to develop any possible way to get into our data, to get into our organizations. How do you envision the next few years given this just ⁓ very non-human way to ⁓ unlock every possible problem?
Marina Segal: I think we should already assume that any possible kind of tool would be available both to attackers and for two defenders. And, assuming that the attackers will get a hold of meters or any other model that, that can find anything, any holes in your environment. We as defense, ⁓ need to adjust and start using those tools ASAP faster and in a more sophisticated way, because we actually have an advantage of knowing what our system looks like from the inside. So we can actually protect, ⁓ put the protection in the right places and make the attackers disabled in the most sensitive entry points. ⁓ So talking about operational efficiency, being operationally Fast is our first and foremost important thing to do. The moment we identify something, the biggest challenge that we have as an industry is the bureaucracy and the processes that we cannot overcome in order to fix something. So we should definitely use AI to solve that problem. It's not even the detection problem. It's not a visibility problem. It's how do we find that right person who will be able to address the right problem at the right time? And how do we use AI without breaking stuff in production in order to fix something without human involvement? And this is a very complex problem because it's not deterministic enough. We have thousands of different services that we are using in each cloud provider at any given moment. And this problem varies between service to service, between misconfiguration and vulnerability. And developing AI tools almost for every single slice of this puzzle is a necessity right now. And the faster we understand that it's not a one problem that we should fix, it's a set of thousands of tens of thousands of small problems that we need to address with AI.
Mickey Haslavsky: ⁓ you know, the more you're talking about the change, the more I keep thinking about how the new design of companies is changing, right? Because we're not building companies in the same way anymore. And for years, cybersecurity has been built around the idea of control, right? Control ⁓ access, control systems, control risks, control people, just a lot of control. But The modern company is becoming too complex to control because it's built off of a black box autonomous systems. Is cybersecurity moving towards like a new type of design or is this always going to be trying to control AI in the way it works?
Marina Segal: believe that we are moving towards totally new design of how we are building cyber companies. ⁓ Cyber companies for decades were built around, here is a thing that I need to protect. How do I protect it? ⁓ I need the visibility, I need a detection, and I need something to automate the next steps. And then humans were taking all of that and building processes around this, right? Any security problem is being solved like this most of the time. Today, what we need to build is actually a solution to a single process problem, right? So that solution delivers an outcome end to end without us needing to customize and build flows around it because the flows are changing so fast and all of the agents are, they need to communicate and it's unpredictable. As humans, are not very good at predicting things that will happen if they are not deterministic. And AI is way better than us. That's why we are so afraid of this, right? So the prediction of what will happen if something is happening, it's a very complex problem that is very complex for humans to solve. So by breaking this huge problem into smaller pieces and almost for every single step of the of the flow of the security universe that we live in, we're going to need to develop that universal piece of solution. That's how I'm thinking about
Mickey Haslavsky: But when you're saying it this way, there will be two layers. will be defenders, attackers, they're going to use AI. ⁓ Every AI agent will try to solve a specific process. In the specific vulnerability, it's going to try to track on the attacker side. And it will be a vicious cycle and an infinite loop of stuff. Defenders and attackers trying to breach each other. But then always, there will be always at least you know, that's how it feels, ⁓ human in the loop. And it seems like what AI brought into the world is a lot of attackers who are trying to attack the people now because they're much more vulnerable than agents because they have less ability to defend themselves. Now AI becomes extremely good at customization and UI. and then you can send any possible email at any given moment and you give an agent the ability to look what is the best way to attack a human. How is this distinction between agents who are going to protect us and the ability of the attackers to just try to attack the people will bridge?
Marina Segal: I'm imagining it slightly different. I'm imagining that there will be no longer humans sitting on top of emails. Like I don't see a need for human looking at the emails every day. And if you have an agent that is looking after your email, you can incorporate the signals about how the agent that is attacking and doing phishing over email is looking like. So that problem, I think it will go away. I don't think we will have... phishing problem when agents are going to be talking to agents, they will be sophisticated enough to solve it on their own. What I think will happen is that there will be two types of defender solutions. One type is the problem that we've solved already that meters kind of put the last dot in solving the detection problem, right? So you will have sensors that will detect everything that we possibly can find. So the detectors or sensors are the things that we are finding that we need to solve. And then there will be another set of cyber tools. And this is where we were not good at so far. And this is where I believe we need to focus is the orchestration or operational efficiency of how do we solve the aggregation of all the problems. What we are seeing in the numbers, I'm sitting on a study that is going to be released about the remediation timelines in the industry. And they are scary. It still takes us more than 30 days to solve criticals. Last year it was 128, so we are getting better, but we are still at over months where the attackers can detect something in milliseconds. So this gap, it has to be breached and this gap will be breached only when we will be able to let agent to fix something in production. And I compare it to self-driving car. I've been using self-driving car for a while, for five years now. And in the beginning, was, I was even joking with my husband that I don't trust developers enough. so that I can let it drive myself. Like I've seen so many as a product manager and as a founder, I just don't trust them enough. And I wouldn't let it drive myself until there was a moment where I was sitting by someone who was using full cell driving mode and I was like, holy crap, it's working. And now...
Mickey Haslavsky: It actually happened.
Marina Segal: 98 % of my driving has been done by a full self-driving car. Yes, I'm still there for 2%, but we got to a point where the cars can drive on their own. Same problem we see in fixing stuff in production environment. We almost need to drive the remediation roads enough times in enough different scenarios, enough different cases and train our autonomous car of remediation or operations for security and train the model. as an industry, what we need to focus on is on, how do we capture enough human data, enough human input so that we can mimic the human behavior? And this is not a one. type of behavior that we need to capture. need to break all the human behaviors and security operations to smaller pieces so that we can capture structured data and train our models on every single piece. So what we've done in Tom Noon, we've broken down the problem to prioritization, triage, investigation, and remediation. And now we are training each one of those pieces has. four or five steps. Each step has its own model that we are training. So it's not one thing that need to happen. We need to build, to break down the process to a manageable amount of problems and train each piece of the puzzle on its own and then aggregate it back so that it's all orchestrated.
Mickey Haslavsky: I know that lots of our listeners are not CISOs, not chief security officers in companies. They're business leaders in different types of businesses all the way from ⁓ low tech to extreme high tech to all types. I think I know what they're thinking right now. They're saying if agents are going to attack agents and it's going to be all agents, will this CISO will be an agent as well?
Marina Segal: potentially in 20, 30 years maybe. ⁓ I don't think we are there yet. If it still takes us over 30 days to fix one vulnerability, ⁓ and if I'm still hearing my customers who are asking me to send them list of findings in PDF, we are still not there. ⁓ But I truly believe that we will be smart enough to involve humans. in the places where we need to involve them, same as we are doing with self-driving cars. I will go back to this analogy a lot because it really helps us to think in a way that helps us to break down this problem to smaller pieces. And it's applicable across any process. if other business leaders are hearing us, marketing, I'm trying to solve a lot of marketing problems right now with you, Mickey, and we are seeing similar patterns in marketing. We can replace BDRs today with agents. However, we still need human to oversee the process and fine tune it constantly because it's not deterministic enough to be working with just one set formula all the time. So I...
Mickey Haslavsky: All right.
Marina Segal: I think what we need to focus on is on breaking down our processes to very small steps and defining in which step humans are to be still involved and those would be similar ⁓ points where we involved approval processes in the past. So if you want to have ⁓ control over your spend, you will involve humans in approval of your budgets, right? Or if your agent thinks that you want to pay more for a certain keyword, you will add money there. Similar things will happen in security. We involve humans always in the change management process, right? Because we didn't want to have changes going into production without being validated. We will still be doing that, except the rest of the 90 % of the process, it will be done by agents.
Mickey Haslavsky: I always ask in this podcast, I was just asking a not the same question and she's overseeing tons of different teams and companies. I believe that there are two teams in the world. Team number one believes that companies will shrink. Team number two believes that ⁓ companies will get larger and more people will be hired because they will be capable of doing more and competition will push them too. in which team are you?
Marina Segal: there will be companies that will expand because of the business opportunity we have right now. And there will be companies that will die.
Mickey Haslavsky: No, I'm asking specifically about team sizes, not like business size, but how big will be the workforce.
Marina Segal: Again, it depends on the team. depends on the team, the team that is ⁓ responsible for talking spend, right? There was no team like that before. There will be new team. The industry will evolve. I believe there will be teams that are responsible for AI and for building with agents and for operational kind of efficiency of the whole thing.
Mickey Haslavsky: Right.
Marina Segal: those teams will expand. In general, if we are thinking on a very high level, I do believe that the team sizes will be smaller because the agents will replace humans for all this specific work, for all of the tasks that took a lot of time and were not very interesting for humans to do anyway.
Mickey Haslavsky: How would you advise? So I assume we have people who are listening. They have been dealing with cybersecurity threats before AI and they're dealing with today. They might not be as advanced technologically as other companies and they might be coming from a lower tech side of the business. you know, anything you can think about all the way from I've been hearing pipe management to storage to whatever you can think about. And they still are afraid and are concerned about cybersecurity breaches. They don't want their employees to get ⁓ attacked. They don't want to be this type of company who got exposed ⁓ with personal documents, which we have seen, unfortunately, in Israel, a very large company being exposed not a while ago. How would you ⁓ how would you advise them of even thinking about this new problem? when it comes to non-tech, of course.
Marina Segal: Yeah. I think in general in cyber, don't think my advice has changed a lot because of the AI. You need to focus on a small number of things that are very powerful. You cannot solve all of the problems, all of the risk is, it's not financially ⁓ optimal to solve all the risk and you will never get there. But you do need to solve the basics, the most important pieces. ⁓ And there are such things. You can define ⁓ minimum security requirements that you as a company would be good enough to sleep in in the night if you have them established. ⁓ For each industry, can be, it will be different. But, you know, if you're really worried about your you hold personal information and you're really worried about it, focus on only protecting that piece of your environment and being very sensitive about who has access to it, how it's been protected. In the end of the day, the principles will not change. You would still have the control over the perimeter of identity. You would still be able to enable zero, what is it called? I have a black. blackout in my mind. ⁓
Mickey Haslavsky: Is your truck? Everything is fine, we are to it, don't worry. We to it, I to I signed and they cut it. There a good teacher, when will you it out?
Marina Segal: I a blackout. That's it, right? Yes. can zero trust, sorry. We will still be able to enable zero trust principle. We will still be able to enable multifactor do backups. So all of those principles, they're not going away. We already know what we need to do as an industry. I think the main thing when it comes to AI era that we live in. is about making us respond faster. And this is the main thing that we need to focus on as an industry, as a whole. How, if I know today that I have something critical in my environment, how fast it will take me to solve it. And I've seen just last month, I've seen two cases of ⁓ two different companies, pretty similar in their non, not advanced technology, as you mentioned. ⁓ They,
Mickey Haslavsky: low-infect.
Marina Segal: They're developing something for something tangible. It's not a software that they are building. And they had similar kind of incident. One company took them 18 hours from the moment we started to the moment that we already tested and did the QA and finished all of the fixing. Another company took them few weeks and they're pretty similar in their size and stage and all of that. So I think if we really wanna go down to the bottom of what we need to do, this is what we need to do. We need to be able to respond faster to anything that happens.
Mickey Haslavsky: I want to double click on this and I want to double click on this because you know, cybersecurity is kind of built on a paradox that says businesses must trust systems because that's how they operate. And now it's becoming even more existential. But security exists because those systems cannot be trusted. And this also becomes extremely just you know, to the edge when it comes to AI. How do I need to think about it as a CEO of company when I incentivize my entire company organization, which hopefully will grow into something large, to build a ton of software and a ton, a ton, a ton of systems to operate on. But I believe with a fear that all of this is just ⁓ not as secure as I would think it is because it was built by non-engineers and et cetera. How this trust paradox must be addressed.
Marina Segal: I think it comes down to the culture and what is important when you're building something. You know, when you are telling the engineering leaders and your teams, what is important to you as a CEO of a company? If you don't mention security, don't expect them to care about it, right? If you don't mention that culture of, you know, treating each other with with respect is important to you and you're not showing it as an example. You cannot expect your employees to behave in a certain way. Similar things are relevant for the security culture in your organization. So we, and I think all the cybersecurity companies have this mindset of being paranoid about what they're building. they are kind of a... ⁓ inherently, they will be a little bit more concerned about building things in a secure way because they just know the space well enough. And what we can do as the leaders of the companies, even if we are not familiar with cyber, is asking questions about the feature that is coming out. Have you thought about privacy? Have you thought about backups in case we are getting ransom. And asking those questions consistently would increase the awareness. I don't think we will be able to solve all the problems by the get-go, but having this in our mindset as a threat, as a risk that we need to address, same to a risk of running out of money or risk of losing our employees, we are always worried about those things. It's just another thing that we as leaders of those companies ⁓ that are starting in this crazy times of AI, we need to start worrying about because in the end of the day, it's going to affect our runway if someone is getting our information out.
Mickey Haslavsky: Yeah, that's true. And I think it becomes even more, as I mentioned, since there are just many more developers in the world today. Some of them are non-engineers and they don't even think about security when they build stuff. They just say, Flod Cod built me a dashboard that collects all of my information into one place and expose it. Yay, it's going to be fun. So that's basically how this world looks like. I think, you know, I even think, you know, that's my take. not... coming from the cybersecurity space. But I do feel like what every CISO I'm talking to is extremely is just concerned about this idea that just the entire organization of our developers were not aware of those stuff. Marina, I think we're coming to the summary of this amazing episode. And I would be very happy to hear, I always ask people who are taking those episodes, ⁓ how do you envision five years from now. ⁓ The reason I'm asking this is because it's impossible. And this will just bring your imagination up.
Marina Segal: ⁓ that's a very tough question. ⁓ I think we all will become more hands-on, ⁓ which is very exciting. I feel like if you really want to run stuff with agents, you really need to understand what they're doing. And I'm not talking about hands-on in terms of writing code, but understanding the details about how the interaction happens and
Mickey Haslavsky: I know, that's why I'm here, that's my job.
Marina Segal: what is happening ⁓ on the backend of our environment is something that will differentiate between people who are successful and people who are not. Because you no longer can be at a high level. It's impossible. And I think all of the mid-level management will fade away ⁓ because there is just no need. So you really need to decide. Are you going to be ⁓ in the top management or are you going to be in the individual contributors who are managing actually teams of agents now? So I think the structure, the org charts will be very different and ⁓ the humans will be interacting way more with technology. There will be a lot of... ⁓ laughing because I hate this word, context switching. We will kind of run many, processes in parallel just in order to save time. ⁓ So our scrolling patterns with like everything that we are doing actually gonna, I think they're gonna help us in work now because we kind of used to move from Facebook to Instagram to work to, I don't know, speaking with someone on the WhatsApp and... ⁓ This will be the similar kind of a parallel processing at work.
Mickey Haslavsky: Marina, I was extremely excited about this because it was the first time when I had anyone from the cybersecurity space. I do have one another person who will be joining down the road. ⁓ But I think it was great to hear in simple terms and in plain English ⁓ how this entire huge threat is affecting each and every one of us. I appreciate your time. Thank you so much for taking it.
Marina Segal: Thank you for having me.
Marina Segal: Thank you, Mickey, for having me.
Mickey Haslavsky: Absolutely. know, cybersecurity has spent years in selling, you know, more visibility, more alerts, more dashboards. And we're getting into a new world where we're saying no more dashboards. It's time for action, which is basically what AI agents are about. Tell me about how you see this world and how can the world protect itself from the extreme velocity of AI.
Marina Segal: Well, we definitely are at the intersection of ⁓ the change in the whole landscape of cybersecurity. We basically seeing that the mass of the defense is changing. have an asymmetrical problem. The attackers are way faster and they don't care about safety. They can break in. They don't care if anything will be running or not. And we are as people who are protecting the industry from from the attackers need to be very careful because we also are on hook for not breaking anything that is working in our operational systems. So the mass of the defense is definitely changing and velocity definitely is one of the hardest problems that we need to solve as an industry.
Mickey Haslavsky: When you're thinking about this whole new world in which new standards and maybe the entire user experience and the way we build stuff is basically changing every, I assume every three months we see like 180 degrees, something new open-closed and there was something else. Like there's literally something new every once in a while. How do you keep up with the speed and how would you... you know, advice people who are just overwhelmed, I assume, with the speed, even have the ability to even keep up with the speed. I'm not even talking about the attackers themselves.
Marina Segal: Yeah, it's definitely a very challenging but also very interesting time to live in because we kind of are reinventing the space right now. If ⁓ about a year ago, we were dealing with developers who are building products and writing code. Today, each developer has a team of agents that are working nearby and are building alongside. So the scale of deployment the amount of pull requests, everything is at scale these days. And ⁓ we are facing as a security teams, I think we also need to adapt to the same mindset that nowadays each security analyst is no longer just an analyst. We have a team of agents that are helping us to secure, not only to build our systems. So the... mindset shift needs to be that each one of us is now managing a team of security experts who are helping to be more productive. ⁓ So nowadays, I think our focus should be on operations and on how to make this whole ⁓ system of agents with human in the loop to be the most productive and the most efficient at any given moment.
Mickey Haslavsky: You know, I want to share my experience with you a little bit. We're selling to different companies all the way from 30 employees to 1000 employees ⁓ with agent to go to market solutions. And every time I walk into a room and I present what we do, there are two types of people. ⁓ Person number one is extremely excited by the opportunity to just outsource or offload some of this extreme work. to agents because they have the ability to scale. The other person is extremely concerned with what this will do to the organization and how this will even change this idea of autonomous software that will do stuff for them. And I think we moved ⁓ somewhere from we found the risk to we solved the risk and leaders are feeling uncomfortable but really want to be forward. How would you advise any leader in any organization to deal with this ⁓ some type of dilemma?
Marina Segal: Yeah, I think we having a psychological problem. think we kind of need a group therapy for the entire industry here because we've been living for a very long time with a perception that our career advancement, the more you move up of the ladder, the more people you need to manage. Right? So that was a very natural kind of an ego. mindset where, oh, my team is 20 people, my team is a hundred people. So the more people you have who are reporting to you, the more senior you are in the organization and the more proud you are of yourself. I think these days we need to understand that in order to make our organization successful, it's no longer about the size of your team, because in the end of the day, the agents are going to be significant in the amount they. I always want to add them to the org chart, right? So that people feel better about how many people report to them. And in the end of the day, it's no longer about the size of the team. It's about outcomes. We all talk about agent outcomes. And I think once the leaders start changing the mindset and making their people more senior because of the outcomes that they deliver rather than the amount of people that they manage, It will make the shift faster because when you're coming and selling an agent and we are seeing the same in the security industry, some people would push back and say, ⁓ I'm going to hire five people offshore and they will do the same. So, and, and it's kind of a counterintuitive for them to take an agent because it's not going to advance their career now. So why wouldn't they hire people offshore? So I think. Once we change the mindset of leaders and make them describe the career progression to their team members based on the outcomes, I think the faster we will make the shift into more ⁓ efficiency driven organizations.
Mickey Haslavsky: This is an interesting conversation because efficiency is such a relative thing in, you know, relative to the organization size and everybody see it in a completely different way. you know, I'll shift a little bit the conversation, but I'm curious about this. We also see, you know, projects such as Mitos or others that are, you know, so, or at least that's what they claim to be. So... ⁓ dangerous when it comes to exposure of any possible breach that the world doesn't want to let them publicly be available to everybody because they're too hard to navigate. But from the other hand, there are attackers, as you just said, and they're looking into any possible way to develop any possible way to get into our data, to get into our organizations. How do you envision the next few years given this just ⁓ very non-human way to ⁓ unlock every possible problem?
Marina Segal: I think we should already assume that any possible kind of tool would be available both to attackers and for two defenders. And, assuming that the attackers will get a hold of meters or any other model that, that can find anything, any holes in your environment. We as defense, ⁓ need to adjust and start using those tools ASAP faster and in a more sophisticated way, because we actually have an advantage of knowing what our system looks like from the inside. So we can actually protect, ⁓ put the protection in the right places and make the attackers disabled in the most sensitive entry points. ⁓ So talking about operational efficiency, being operationally Fast is our first and foremost important thing to do. The moment we identify something, the biggest challenge that we have as an industry is the bureaucracy and the processes that we cannot overcome in order to fix something. So we should definitely use AI to solve that problem. It's not even the detection problem. It's not a visibility problem. It's how do we find that right person who will be able to address the right problem at the right time? And how do we use AI without breaking stuff in production in order to fix something without human involvement? And this is a very complex problem because it's not deterministic enough. We have thousands of different services that we are using in each cloud provider at any given moment. And this problem varies between service to service, between misconfiguration and vulnerability. And developing AI tools almost for every single slice of this puzzle is a necessity right now. And the faster we understand that it's not a one problem that we should fix, it's a set of thousands of tens of thousands of small problems that we need to address with AI.
Mickey Haslavsky: ⁓ you know, the more you're talking about the change, the more I keep thinking about how the new design of companies is changing, right? Because we're not building companies in the same way anymore. And for years, cybersecurity has been built around the idea of control, right? Control ⁓ access, control systems, control risks, control people, just a lot of control. But The modern company is becoming too complex to control because it's built off of a black box autonomous systems. Is cybersecurity moving towards like a new type of design or is this always going to be trying to control AI in the way it works?
Marina Segal: believe that we are moving towards totally new design of how we are building cyber companies. ⁓ Cyber companies for decades were built around, here is a thing that I need to protect. How do I protect it? ⁓ I need the visibility, I need a detection, and I need something to automate the next steps. And then humans were taking all of that and building processes around this, right? Any security problem is being solved like this most of the time. Today, what we need to build is actually a solution to a single process problem, right? So that solution delivers an outcome end to end without us needing to customize and build flows around it because the flows are changing so fast and all of the agents are, they need to communicate and it's unpredictable. As humans, are not very good at predicting things that will happen if they are not deterministic. And AI is way better than us. That's why we are so afraid of this, right? So the prediction of what will happen if something is happening, it's a very complex problem that is very complex for humans to solve. So by breaking this huge problem into smaller pieces and almost for every single step of the of the flow of the security universe that we live in, we're going to need to develop that universal piece of solution. That's how I'm thinking about
Mickey Haslavsky: But when you're saying it this way, there will be two layers. will be defenders, attackers, they're going to use AI. ⁓ Every AI agent will try to solve a specific process. In the specific vulnerability, it's going to try to track on the attacker side. And it will be a vicious cycle and an infinite loop of stuff. Defenders and attackers trying to breach each other. But then always, there will be always at least you know, that's how it feels, ⁓ human in the loop. And it seems like what AI brought into the world is a lot of attackers who are trying to attack the people now because they're much more vulnerable than agents because they have less ability to defend themselves. Now AI becomes extremely good at customization and UI. and then you can send any possible email at any given moment and you give an agent the ability to look what is the best way to attack a human. How is this distinction between agents who are going to protect us and the ability of the attackers to just try to attack the people will bridge?
Marina Segal: I'm imagining it slightly different. I'm imagining that there will be no longer humans sitting on top of emails. Like I don't see a need for human looking at the emails every day. And if you have an agent that is looking after your email, you can incorporate the signals about how the agent that is attacking and doing phishing over email is looking like. So that problem, I think it will go away. I don't think we will have... phishing problem when agents are going to be talking to agents, they will be sophisticated enough to solve it on their own. What I think will happen is that there will be two types of defender solutions. One type is the problem that we've solved already that meters kind of put the last dot in solving the detection problem, right? So you will have sensors that will detect everything that we possibly can find. So the detectors or sensors are the things that we are finding that we need to solve. And then there will be another set of cyber tools. And this is where we were not good at so far. And this is where I believe we need to focus is the orchestration or operational efficiency of how do we solve the aggregation of all the problems. What we are seeing in the numbers, I'm sitting on a study that is going to be released about the remediation timelines in the industry. And they are scary. It still takes us more than 30 days to solve criticals. Last year it was 128, so we are getting better, but we are still at over months where the attackers can detect something in milliseconds. So this gap, it has to be breached and this gap will be breached only when we will be able to let agent to fix something in production. And I compare it to self-driving car. I've been using self-driving car for a while, for five years now. And in the beginning, was, I was even joking with my husband that I don't trust developers enough. so that I can let it drive myself. Like I've seen so many as a product manager and as a founder, I just don't trust them enough. And I wouldn't let it drive myself until there was a moment where I was sitting by someone who was using full cell driving mode and I was like, holy crap, it's working. And now...
Mickey Haslavsky: It actually happened.
Marina Segal: 98 % of my driving has been done by a full self-driving car. Yes, I'm still there for 2%, but we got to a point where the cars can drive on their own. Same problem we see in fixing stuff in production environment. We almost need to drive the remediation roads enough times in enough different scenarios, enough different cases and train our autonomous car of remediation or operations for security and train the model. as an industry, what we need to focus on is on, how do we capture enough human data, enough human input so that we can mimic the human behavior? And this is not a one. type of behavior that we need to capture. need to break all the human behaviors and security operations to smaller pieces so that we can capture structured data and train our models on every single piece. So what we've done in Tom Noon, we've broken down the problem to prioritization, triage, investigation, and remediation. And now we are training each one of those pieces has. four or five steps. Each step has its own model that we are training. So it's not one thing that need to happen. We need to build, to break down the process to a manageable amount of problems and train each piece of the puzzle on its own and then aggregate it back so that it's all orchestrated.
Mickey Haslavsky: I know that lots of our listeners are not CISOs, not chief security officers in companies. They're business leaders in different types of businesses all the way from ⁓ low tech to extreme high tech to all types. I think I know what they're thinking right now. They're saying if agents are going to attack agents and it's going to be all agents, will this CISO will be an agent as well?
Marina Segal: potentially in 20, 30 years maybe. ⁓ I don't think we are there yet. If it still takes us over 30 days to fix one vulnerability, ⁓ and if I'm still hearing my customers who are asking me to send them list of findings in PDF, we are still not there. ⁓ But I truly believe that we will be smart enough to involve humans. in the places where we need to involve them, same as we are doing with self-driving cars. I will go back to this analogy a lot because it really helps us to think in a way that helps us to break down this problem to smaller pieces. And it's applicable across any process. if other business leaders are hearing us, marketing, I'm trying to solve a lot of marketing problems right now with you, Mickey, and we are seeing similar patterns in marketing. We can replace BDRs today with agents. However, we still need human to oversee the process and fine tune it constantly because it's not deterministic enough to be working with just one set formula all the time. So I...
Mickey Haslavsky: All right.
Marina Segal: I think what we need to focus on is on breaking down our processes to very small steps and defining in which step humans are to be still involved and those would be similar ⁓ points where we involved approval processes in the past. So if you want to have ⁓ control over your spend, you will involve humans in approval of your budgets, right? Or if your agent thinks that you want to pay more for a certain keyword, you will add money there. Similar things will happen in security. We involve humans always in the change management process, right? Because we didn't want to have changes going into production without being validated. We will still be doing that, except the rest of the 90 % of the process, it will be done by agents.
Mickey Haslavsky: I always ask in this podcast, I was just asking a not the same question and she's overseeing tons of different teams and companies. I believe that there are two teams in the world. Team number one believes that companies will shrink. Team number two believes that ⁓ companies will get larger and more people will be hired because they will be capable of doing more and competition will push them too. in which team are you?
Marina Segal: there will be companies that will expand because of the business opportunity we have right now. And there will be companies that will die.
Mickey Haslavsky: No, I'm asking specifically about team sizes, not like business size, but how big will be the workforce.
Marina Segal: Again, it depends on the team. depends on the team, the team that is ⁓ responsible for talking spend, right? There was no team like that before. There will be new team. The industry will evolve. I believe there will be teams that are responsible for AI and for building with agents and for operational kind of efficiency of the whole thing.
Mickey Haslavsky: Right.
Marina Segal: those teams will expand. In general, if we are thinking on a very high level, I do believe that the team sizes will be smaller because the agents will replace humans for all this specific work, for all of the tasks that took a lot of time and were not very interesting for humans to do anyway.
Mickey Haslavsky: How would you advise? So I assume we have people who are listening. They have been dealing with cybersecurity threats before AI and they're dealing with today. They might not be as advanced technologically as other companies and they might be coming from a lower tech side of the business. you know, anything you can think about all the way from I've been hearing pipe management to storage to whatever you can think about. And they still are afraid and are concerned about cybersecurity breaches. They don't want their employees to get ⁓ attacked. They don't want to be this type of company who got exposed ⁓ with personal documents, which we have seen, unfortunately, in Israel, a very large company being exposed not a while ago. How would you ⁓ how would you advise them of even thinking about this new problem? when it comes to non-tech, of course.
Marina Segal: Yeah. I think in general in cyber, don't think my advice has changed a lot because of the AI. You need to focus on a small number of things that are very powerful. You cannot solve all of the problems, all of the risk is, it's not financially ⁓ optimal to solve all the risk and you will never get there. But you do need to solve the basics, the most important pieces. ⁓ And there are such things. You can define ⁓ minimum security requirements that you as a company would be good enough to sleep in in the night if you have them established. ⁓ For each industry, can be, it will be different. But, you know, if you're really worried about your you hold personal information and you're really worried about it, focus on only protecting that piece of your environment and being very sensitive about who has access to it, how it's been protected. In the end of the day, the principles will not change. You would still have the control over the perimeter of identity. You would still be able to enable zero, what is it called? I have a black. blackout in my mind. ⁓
Mickey Haslavsky: Is your truck? Everything is fine, we are to it, don't worry. We to it, I to I signed and they cut it. There a good teacher, when will you it out?
Marina Segal: I a blackout. That's it, right? Yes. can zero trust, sorry. We will still be able to enable zero trust principle. We will still be able to enable multifactor do backups. So all of those principles, they're not going away. We already know what we need to do as an industry. I think the main thing when it comes to AI era that we live in. is about making us respond faster. And this is the main thing that we need to focus on as an industry, as a whole. How, if I know today that I have something critical in my environment, how fast it will take me to solve it. And I've seen just last month, I've seen two cases of ⁓ two different companies, pretty similar in their non, not advanced technology, as you mentioned. ⁓ They,
Mickey Haslavsky: low-infect.
Marina Segal: They're developing something for something tangible. It's not a software that they are building. And they had similar kind of incident. One company took them 18 hours from the moment we started to the moment that we already tested and did the QA and finished all of the fixing. Another company took them few weeks and they're pretty similar in their size and stage and all of that. So I think if we really wanna go down to the bottom of what we need to do, this is what we need to do. We need to be able to respond faster to anything that happens.
Mickey Haslavsky: I want to double click on this and I want to double click on this because you know, cybersecurity is kind of built on a paradox that says businesses must trust systems because that's how they operate. And now it's becoming even more existential. But security exists because those systems cannot be trusted. And this also becomes extremely just you know, to the edge when it comes to AI. How do I need to think about it as a CEO of company when I incentivize my entire company organization, which hopefully will grow into something large, to build a ton of software and a ton, a ton, a ton of systems to operate on. But I believe with a fear that all of this is just ⁓ not as secure as I would think it is because it was built by non-engineers and et cetera. How this trust paradox must be addressed.
Marina Segal: I think it comes down to the culture and what is important when you're building something. You know, when you are telling the engineering leaders and your teams, what is important to you as a CEO of a company? If you don't mention security, don't expect them to care about it, right? If you don't mention that culture of, you know, treating each other with with respect is important to you and you're not showing it as an example. You cannot expect your employees to behave in a certain way. Similar things are relevant for the security culture in your organization. So we, and I think all the cybersecurity companies have this mindset of being paranoid about what they're building. they are kind of a... ⁓ inherently, they will be a little bit more concerned about building things in a secure way because they just know the space well enough. And what we can do as the leaders of the companies, even if we are not familiar with cyber, is asking questions about the feature that is coming out. Have you thought about privacy? Have you thought about backups in case we are getting ransom. And asking those questions consistently would increase the awareness. I don't think we will be able to solve all the problems by the get-go, but having this in our mindset as a threat, as a risk that we need to address, same to a risk of running out of money or risk of losing our employees, we are always worried about those things. It's just another thing that we as leaders of those companies ⁓ that are starting in this crazy times of AI, we need to start worrying about because in the end of the day, it's going to affect our runway if someone is getting our information out.
Mickey Haslavsky: Yeah, that's true. And I think it becomes even more, as I mentioned, since there are just many more developers in the world today. Some of them are non-engineers and they don't even think about security when they build stuff. They just say, Flod Cod built me a dashboard that collects all of my information into one place and expose it. Yay, it's going to be fun. So that's basically how this world looks like. I think, you know, I even think, you know, that's my take. not... coming from the cybersecurity space. But I do feel like what every CISO I'm talking to is extremely is just concerned about this idea that just the entire organization of our developers were not aware of those stuff. Marina, I think we're coming to the summary of this amazing episode. And I would be very happy to hear, I always ask people who are taking those episodes, ⁓ how do you envision five years from now. ⁓ The reason I'm asking this is because it's impossible. And this will just bring your imagination up.
Marina Segal: ⁓ that's a very tough question. ⁓ I think we all will become more hands-on, ⁓ which is very exciting. I feel like if you really want to run stuff with agents, you really need to understand what they're doing. And I'm not talking about hands-on in terms of writing code, but understanding the details about how the interaction happens and
Mickey Haslavsky: I know, that's why I'm here, that's my job.
Marina Segal: what is happening ⁓ on the backend of our environment is something that will differentiate between people who are successful and people who are not. Because you no longer can be at a high level. It's impossible. And I think all of the mid-level management will fade away ⁓ because there is just no need. So you really need to decide. Are you going to be ⁓ in the top management or are you going to be in the individual contributors who are managing actually teams of agents now? So I think the structure, the org charts will be very different and ⁓ the humans will be interacting way more with technology. There will be a lot of... ⁓ laughing because I hate this word, context switching. We will kind of run many, processes in parallel just in order to save time. ⁓ So our scrolling patterns with like everything that we are doing actually gonna, I think they're gonna help us in work now because we kind of used to move from Facebook to Instagram to work to, I don't know, speaking with someone on the WhatsApp and... ⁓ This will be the similar kind of a parallel processing at work.
Mickey Haslavsky: Marina, I was extremely excited about this because it was the first time when I had anyone from the cybersecurity space. I do have one another person who will be joining down the road. ⁓ But I think it was great to hear in simple terms and in plain English ⁓ how this entire huge threat is affecting each and every one of us. I appreciate your time. Thank you so much for taking it.
Marina Segal: Thank you for having me.
